topic Maximum number of addresses exceeded in Panorama Discussions

Maximum number of addresses exceeded

AhamadullahM — Sat, 05 Aug 2023 09:54:35 GMT

Hi All,

We are facing the below issue while committing and pushing the configuration to the device from Panorama. We have already "unchecked Share Unused Address and Service Objects with Devices" but still we are facing the issue Kindly help to resolve the issue.

Details:
. Validation Error:
. address constraints failed : Maximum number of addresses exceeded
. address is invalid
. Warning: No Valid DNS Security License
. Error: Number of addresses, dynamic groups, external-ip-lists, external-predefined-ip-lists and predefined ip-block-lists (3520) exceeds platform capacity (3500)
. (Module: device)
. client device phase 1 failure
. Commit failed

Thanks you all for your prompt responses

Re: Maximum number of addresses exceeded

TomYoung — Sat, 05 Aug 2023 10:45:18 GMT

Hi @AhamadullahM ,

The problem may not be your number of addresses or dynamic groups, but rather the number of entries in your external-ip-lists, external-predefined-ip-lists and predefined ip-block-lists.

On the NGFW (not Panorama), click on each custom EDL under Objects > External Dynamic List (or External Block List) and then click on List Entries and Exceptions and add up the total number of entries for all of them.

What PAN-OS version and platform do you have?

Thanks,

Tom

Re: Maximum number of addresses exceeded

AhamadullahM — Sat, 05 Aug 2023 11:18:23 GMT

Hi ,

The current PAN-OS version is 10.1.5

I have added more info, We have 3 administrator profiles and two administrator profiles have the facing issue.

Re: Maximum number of addresses exceeded

ozheng — Sat, 05 Aug 2023 12:52:36 GMT

Hello AhamadullahM,

You need to "cleanup" your config : remove the address objects you are not needing anymore, aggregate some entries (2 IP address in the same subnet can be directly defined in a subnet for instance).

For now, you simply need to remove 20 address objects.

Or you consider to upgrade to a platform with higher platform limit.

Also, if you are in multi-vsys, upgrading to 10.2 can save you some objects (thank to how shared objects are managed from 10.2).

Olivier

Re: Maximum number of addresses exceeded

jschwier — Tue, 10 Dec 2024 12:31:53 GMT

Dear all,
we do have the same problem on customer site since upgrade to 10.1.x.

All the systems are PA-220, PA-820 and PA-850.

The commit works on some systems, but not on others. The message that the number of address objects is exhausted is displayed again and again.
Strangely enough, the commit works some time later on some systems that previously had the problem.

In addition, the number of addresses in the error message is exactly four higher than currently available in the panorama.
No matter how many we delete or add.

Due to the fact that the commit work after some time we do not open a case.
But I think this seems to be more a bug on Panorama, which try to push all addresses to the device. Redardless of the switch "Share Unused Address and Service Objects with Devices".

Joachim